@miraland-labs/conduit-bridge 0.16.110 → 0.16.111

package/dist/driver.js

@@ -7,6 +7,18 @@ import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { z } from "zod";
 import { allowsExternalFetch, deniedCommands, executionClassPromptRules, isRunnableVerificationCommand, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
+/**
+ * Classify one Cursor `status` / Kiro `whoami` probe. Signed-out phrases win; an unanswered
+ * probe (timeout, spawn error, empty output, or text that names neither state) is unknown.
+ */
+export function readSignInStatus(result, signedInPattern) {
+    const text = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+    if (/not logged in|not authenticated|login required/i.test(text))
+        return "signed_out";
+    if (result.code === 0 && signedInPattern.test(text))
+        return "signed_in";
+    return "unknown";
+}
 /**
  * The bound for this turn.
  *
@@ -1017,10 +1029,10 @@ export const cursorDriver = {
             return { status: "failed", resultText: null, sessionId: null, error: "cursor preflight found no bounded verification command for the test_run grant" };
         }
         // A ~/.cursor directory exists even after logout — ask the CLI itself.
-        // `agent status` exits 0 either way, so the text is the signal.
+        // `agent status` exits 0 either way; only a definite signed_out fails closed.
         if (!process.env.CURSOR_API_KEY) {
             const status = await execute(executable, ["status"], input.workspace, 15_000, undefined, "local");
-            if (status.code !== 0 || !/logged in as/i.test(`${status.stdout}\n${status.stderr}`)) {
+            if (readSignInStatus(status, /logged in as/i) === "signed_out") {
                 return { status: "failed", resultText: null, sessionId: null, error: "cursor has no login (set CURSOR_API_KEY or run `agent login`)" };
             }
         }

package/dist/preflight.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
 import { resolveMaxTurns } from "./execution-budget.js";
-import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, } from "./driver.js";
+import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, readSignInStatus, } from "./driver.js";
 import { laneQuota, laneTierBindings, localFuelOnlyDriver, onlineDriverIds, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
 /** Protocol 3: read-only diagnosis can reuse a retained failed-attempt worktree. */
 // 4: each driver snapshot reports diagnosis_read_only, so the control plane can require a
@@ -128,7 +128,35 @@ async function driverCompatibilityFingerprint(driver, workspace, run) {
         features,
     })).digest("hex");
 }
-async function localAuthenticationReady(driver, workspace, run) {
+/** Last definite Cursor/Kiro sign-in answer. Unknown never writes here. */
+export const lastSignIn = new Map();
+export function resetSignInMemoryForTests() {
+    lastSignIn.clear();
+}
+/** Retry once on unknown, then the last definite answer, then signed-in with a warning. */
+export async function resolveSignInAnswer(driver, probe) {
+    const once = async () => {
+        try {
+            return await probe();
+        }
+        catch {
+            return "unknown";
+        }
+    };
+    let answer = await once();
+    if (answer === "unknown")
+        answer = await once();
+    if (answer !== "unknown") {
+        lastSignIn.set(driver, answer);
+        return answer;
+    }
+    const previous = lastSignIn.get(driver);
+    if (previous)
+        return previous;
+    console.warn(`sign-in unverified (${driver})`);
+    return "signed_in";
+}
+export async function localAuthenticationReady(driver, workspace, run) {
     if (driver === "claude-code")
         return hasClaudeLogin();
     if (driver === "codex")
@@ -142,14 +170,12 @@ async function localAuthenticationReady(driver, workspace, run) {
     if (driver === "cursor") {
         if (process.env.CURSOR_API_KEY)
             return true;
-        const status = await run(driverExecutable(driver), ["status"], workspace);
-        return status.code === 0 && /logged in as/i.test(`${status.stdout}\n${status.stderr}`);
+        return (await resolveSignInAnswer(driver, async () => readSignInStatus(await run(driverExecutable(driver), ["status"], workspace), /logged in as/i))) !== "signed_out";
     }
     if (driver === "kiro") {
         if (process.env.KIRO_API_KEY)
             return true;
-        const status = await run(driverExecutable(driver), ["whoami"], workspace);
-        return status.code === 0 && !/not logged in|not authenticated|login required/i.test(`${status.stdout}\n${status.stderr}`);
+        return (await resolveSignInAnswer(driver, async () => readSignInStatus(await run(driverExecutable(driver), ["whoami"], workspace), /\S/))) !== "signed_out";
     }
     // Pi stores provider auth in its own config; CLI has no stable whoami — version probe is enough.
     if (driver === "pi")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.110",
+  "version": "0.16.111",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {